AWS Certification Developer Associate 2025 past questions and answers

1. Read the entire orders table before each write and skip the write if the order ID appears.
2. Use PutItem with a ConditionExpression that requires the order ID key not to exist, and treat a conditional-check failure as an already-processed order.
3. Disable retries on the upstream service and write each event with an unconditional PutItem.
4. Keep processed order IDs in a Lambda execution environment variable.

Answer: B. Use PutItem with a ConditionExpression that requires the order ID key not to exist, and treat a conditional-check failure as an already-processed order.

A conditional write makes the uniqueness check and insertion atomic, so concurrent or repeated deliveries cannot create a second record. A separate read before writing can race, and Lambda environments are not durable idempotency stores.

1. Require each customer to sign requests with long-term IAM access keys.
2. Use an API key as the authentication mechanism and rotate it in the mobile application.
3. Configure an Amazon Cognito user pool authorizer on the API and pass the customer's user-pool token.
4. Use an IAM authorizer that accepts only requests signed with SigV4.

Answer: C. Configure an Amazon Cognito user pool authorizer on the API and pass the customer's user-pool token.

A Cognito user pool authorizer validates user tokens directly at API Gateway without distributing AWS credentials to customers. API keys are for usage identification and throttling, not user authentication, while IAM authorization requires signed AWS requests.

1. Configure a SAM deployment preference for a 10-percent, five-minute canary and associate CloudWatch alarms for rollback.
2. Replace the production function with the new code in one all-at-once update and manually restore the prior package if needed.
3. Create a second function and ask clients to alternate between the two function ARNs.
4. Deploy the function to an EC2 Auto Scaling group and use an instance refresh.

Answer: A. Configure a SAM deployment preference for a 10-percent, five-minute canary and associate CloudWatch alarms for rollback.

SAM can use CodeDeploy traffic shifting for Lambda aliases, including canary timing and alarm-triggered rollback. An all-at-once update has no gradual exposure, and client-side traffic management adds unnecessary operational work.

1. Increase the queue retention period so the successful messages remain available longer.
2. Move the queue to FIFO and set a unique message group ID for every message.
3. Set the Lambda timeout to zero so failed messages are immediately discarded.
4. Enable ReportBatchItemFailures on the event source mapping and return identifiers only for messages that failed.

Answer: D. Enable ReportBatchItemFailures on the event source mapping and return identifiers only for messages that failed.

The SQS partial batch response lets Lambda delete successful messages and retry only the reported failures. Without it, a failed batch can cause all messages in that batch to be retried.

1. Put an IAM user's access key in an encrypted environment variable in the task definition.
2. Assign a task role whose policy grants s3:GetObject only on the required customer-exports object ARN prefix.
3. Grant the task execution role broad S3 read access because it is already used by Fargate.
4. Make the bucket public and validate the requested prefix in application code.

Answer: B. Assign a task role whose policy grants s3:GetObject only on the required customer-exports object ARN prefix.

The ECS task role provides temporary credentials to application code and can be restricted to the required object prefix. The task execution role is for ECS operations such as image pulls and log delivery, and public access or embedded keys is less secure.